A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when a specifically crafted FTP command is sent to the device. This vulnerability can lead to significant availability impacts, making it critical for affected users to address it promptly. The issue arises from insufficient validation of input data, allowing for potential exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-6625 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted FTP command to the affected device. Given the low attack complexity and the fact that no privileges are required, this can be executed remotely over the network, potentially leading to a Denial Of Service condition.
Affected Products
- Schneider Electric FTP-enabled devices: These devices are susceptible to the Denial Of Service attack due to improper input validation.
Mitigation
To mitigate this vulnerability, users should ensure that their devices are updated with the latest security patches provided by Schneider Electric. Additionally, implementing network security measures such as firewalls to restrict unauthorized access to FTP services can help reduce the risk of exploitation.